Wirus - Ukash, prośba o pomoc

[archiello (Arturmlawa)]

Witam,

nie wiem czy mój poprzedni post dotarł.

Zainfekował mnie ten Ukash - widzę że trzeba zrobić w OTL skan, więc zrobiłem i podsyłam

http://wklej.org/id/802820/

http://wklej.org/id/802822/

Serdeczna prośba o pomoc !

– Dodane 03.08.2012 (Pt) 8:26 –

Pomoże ktoś ?

[Acorus]

Odinstaluj Babylon toolbar on IE,Browsers Protector,Contextual Tool Extrafind,GameBox Toolbar, LiveVDO plugin 1.3,McAfee Security Scan Plus,SpeedBit Toolbar,StartSearch Toolbar 1.3.Uruchom OTL i w okno (Własne opcje skanowania/Script)wklej:

:OTL SRV - File not found [On_Demand | Stopped] – C:\Program Files\BullGuard Software\BullGuard\support\bgrasvc.exe – (BGRaSvc) DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\ewusbmdm.sys – (hwdatacard) DRV - File not found [Kernel | On_Demand | Stopped] – System32\drivers\dgderdrv.sys – (dgderdrv) DRV - File not found [File_System | On_Demand | Stopped] – C:\Program Files\Anti Trojan Elite\ATEPMon.sys – (ATE_PROCMON) IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://startsear.ch/?aff=1&cf=b3ccba8c- … 030d80382a IE - HKLM…\SearchScopes{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: “URL” = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKLM…\SearchScopes{0FEF2D2C-CDA6-45E4-B2ED-9DF7C50C95FF}: “URL” = http://startsear.ch/?aff=2&src=sp&cf=b3 … d80382a&q={searchTerms} IE - HKLM…\SearchScopes{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: “URL” = http://startsear.ch/?aff=1&src=sp&cf=b3 … d80382a&q={searchTerms} IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?affID=112465 … 1060d1401a IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://vshare.toolbarhome.com/?hp=df IE - HKCU…\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} - No CLSID value found IE - HKCU…\SearchScopes{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: “URL” = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKCU…\SearchScopes{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: “URL” = http://search.babylon.com/?q={searchTerms}&affID=112465&tt=060612_7_&babsrc=SP_ss&mntrId=94c9d2ad000000000000001060d1401a IE - HKCU…\SearchScopes{0FEF2D2C-CDA6-45E4-B2ED-9DF7C50C95FF}: “URL” = http://startsear.ch/?aff=2&src=sp&cf=b3 … d80382a&q={searchTerms} IE - HKCU…\SearchScopes{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: “URL” = http://websearch.ask.com/redirect?clien … src=crm&q={searchTerms}&locale=en_US&apn_ptnrs=U3&apn_dtid=OSJ000YYPL&apn_uid=4F4AF311-F5E4-4788-BBD1-AF9F8A8D9AC5&apn_sauid=39FA0234-34C2-40C3-B13F-ACAE9FE1D046 IE - HKCU…\SearchScopes{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}: “URL” = http://search.yahoo.com/search?fr=vmn&t … a-ch-rp&q={searchTerms} IE - HKCU…\SearchScopes{8679FF57-7B98-4e63-B86D-FA4B96D7B441}: “URL” = http://search.speedbit.com/searchresult … default&q={searchTerms} IE - HKCU…\SearchScopes{A67EB6D4-84A3-4FBA-87C4-93630230BCF2}: “URL” = http://websearch.ask.com/redirect?clien … src=crm&q={searchTerms}&locale=en_US&apn_ptnrs=U3&apn_dtid=OSJ000YYPL&apn_uid=4F4AF311-F5E4-4788-BBD1-AF9F8A8D9AC5&apn_sauid=39FA0234-34C2-40C3-B13F-ACAE9FE1D046 IE - HKCU…\SearchScopes{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB9}: “URL” = http://www.daemon-search.com/search?q={searchTerms} IE - HKCU…\SearchScopes{CFF6C558-6BE3-44B7-92E9-187B59B148DB}: “URL” = http://gbt.toolbarhome.com/search.aspx?q={searchTerms}&srch=dsp [2012-01-02 11:48:42 | 000,083,456 | ---- | M] (StartSearch ) – C:\Program Files\mozilla firefox\plugins\npvsharetvplg.dll O3 - HKLM…\Toolbar: (GameBox Toolbar) - {0FEF2D2C-CDA6-45E4-B2ED-9DF7C50C95FF} - C:\Program Files\GameBox\gamebox_toolbar.dll () O3 - HKLM…\Toolbar: (StartSearchToolBar) - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - C:\Program Files\StartSearch plugin\ssBarLcher.dll (StartSearch Inc.) O3 - HKLM…\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll (Babylon Ltd.) O3 - HKLM…\Toolbar: (no name) - {EBFCD017-BCAD-42C3-9ED5-89DBDFC59171} - No CLSID value found. O3 - HKCU…\Toolbar\WebBrowser: (GameBox Toolbar) - {0FEF2D2C-CDA6-45E4-B2ED-9DF7C50C95FF} - C:\Program Files\GameBox\gamebox_toolbar.dll () O3 - HKCU…\Toolbar\WebBrowser: (StartSearchToolBar) - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - C:\Program Files\StartSearch plugin\ssBarLcher.dll (StartSearch Inc.) O4 - HKLM…\Run: [Anti Trojan Elite] C:\Program Files\Anti Trojan Elite\TJEnder.exe :NO File not found O4 - HKLM…\Run: [browsers Protector] C:\Program Files\Browsers Protector\regmon32.exe () O4 - HKLM…\Run: [eihxheiafpbtapj] C:\Documents and Settings\All Users\Dane aplikacji\eihxheia.exe () O4 - HKCU…\Run: [eihxheiafpbtapj] C:\Documents and Settings\All Users\Dane aplikacji\eihxheia.exe () O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: keyhole.com = C:\Documents and Settings\Artur Bubrowiecki\Dane aplikacji\csrss.exe [2012-08-01 21:20:20 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Dane aplikacji\dvbfpvqefkushli [2012-08-01 21:20:22 | 000,000,051 | ---- | M] () – C:\Documents and Settings\All Users\Dane aplikacji\gnxwiaojxbztgmq [2012-08-01 21:20:14 | 000,061,440 | ---- | M] () – C:\Documents and Settings\All Users\Dane aplikacji\vwarnrzu.exe [2012-08-01 21:20:14 | 000,061,440 | ---- | M] () – C:\Documents and Settings\All Users\Dane aplikacji\eihxheia.exe [2012-08-01 21:20:14 | 000,061,440 | ---- | M] () – C:\Documents and Settings\All Users\Dane aplikacji\chipqlpo.exe [2012-08-01 21:20:14 | 000,061,440 | ---- | M] () – C:\Documents and Settings\Artur Bubrowiecki\0.25211978090218257.exe [2011-04-19 21:13:22 | 000,012,274 | -HS- | C] () – C:\Documents and Settings\Artur Bubrowiecki\Ustawienia lokalne\Dane aplikacji\64uy677iby72x2r4gj86f3kdb27y451070j3kvldf2 [2011-04-19 21:13:22 | 000,012,274 | -HS- | C] () – C:\Documents and Settings\All Users\Dane aplikacji\64uy677iby72x2r4gj86f3kdb27y451070j3kvldf2 :Commands [emptytemp]

Kliknij Wykonaj skrypt.

Zatwierdź restart komputera. Zapisz raport, który pokaże się po restarcie. Następnie uruchom OTL ponownie, tym razem kliknij (Skanuj).

Pokaż nowy log OTL.txt oraz raport z usuwania.